hydro-ai-helper 1.8.5 → 1.10.0

package/.github/AUTOMATION.md

@@ -0,0 +1,280 @@
+# GitHub Actions 自动发布配置指南
+
+## 📦 功能说明
+
+当你推送新的 git tag（如 `v1.8.6`）到 GitHub 时，会自动：
+1. ✅ 构建 TypeScript 代码
+2. ✅ 验证版本号一致性
+3. ✅ 发布到 npm
+4. ✅ 创建 GitHub Release
+
+---
+
+## 🔧 配置步骤
+
+### Step 1: 创建 npm Automation Token
+
+1. **访问** npm Tokens 页面：
+   https://www.npmjs.com/settings/npmdwhguieg/tokens
+
+2. **点击** "Generate New Token"
+
+3. **选择配置**：
+   - **Token Type**: `Granular Access Token` 或 `Automation`
+   - **Expiration**: 建议 `No expiration` 或 `365 days`
+   - **Packages and scopes**:
+     - Permissions: `Read and write`
+     - Packages: `hydro-ai-helper` 或 `All packages`
+
+4. **完成安全验证**（指纹/密钥）
+
+5. **复制生成的 token**（格式：`npm_xxxxxxxxxxxxx`）
+   - ⚠️ **重要**：token 只会显示一次，请立即保存
+
+---
+
+### Step 2: 添加 GitHub Secret
+
+1. **访问** 你的 GitHub 仓库设置：
+   https://github.com/AltureT/hydro-ai-helper/settings/secrets/actions
+
+2. **点击** "New repository secret"
+
+3. **填写信息**：
+   - **Name**: `NPM_TOKEN`（必须完全一致）
+   - **Secret**: 粘贴你刚才复制的 npm token
+
+4. **点击** "Add secret"
+
+---
+
+### Step 3: 验证配置
+
+运行以下命令测试自动发布：
+
+```bash
+# 1. 确保代码已提交
+git status
+
+# 2. 升级版本号（例如 1.8.5 → 1.8.6）
+npm version patch  # 或 minor/major
+
+# 3. 推送代码和 tag
+git push origin main --tags
+
+# 4. 查看 GitHub Actions 执行情况
+# 访问：https://github.com/AltureT/hydro-ai-helper/actions
+```
+
+---
+
+## 🚀 使用流程
+
+### 发布新版本的完整流程
+
+```bash
+# 1. 修改代码并测试
+npm run build:plugin
+npm test  # 如果有测试
+
+# 2. 提交代码
+git add .
+git commit -m "feat: 新功能描述"
+
+# 3. 升级版本（自动修改 package.json 并创建 git tag）
+npm version patch  # 小版本：1.8.5 → 1.8.6
+# 或
+npm version minor  # 中版本：1.8.6 → 1.9.0
+# 或
+npm version major  # 大版本：1.9.0 → 2.0.0
+
+# 4. 推送（触发自动发布）
+git push origin main --tags
+```
+
+**自动执行**：
+- ✅ GitHub Actions 检测到新 tag
+- ✅ ���动构建、测试、发布
+- ✅ 创建 GitHub Release
+- ✅ 5-10 分钟后在 npm 上可见
+
+---
+
+## 📋 版本号规范
+
+遵循 [Semantic Versioning](https://semver.org/lang/zh-CN/)：
+
+- **Patch** (1.8.5 → 1.8.6)：Bug 修复、小改进
+- **Minor** (1.8.6 → 1.9.0)：新功能（向后兼容）
+- **Major** (1.9.0 → 2.0.0)：破坏性变更（不向后兼容）
+
+**Tag 格式**：
+- ✅ 正确：`v1.8.6`, `v2.0.0`, `v1.9.0-beta.1`
+- ❌ 错误：`1.8.6`, `version-1.8.6`, `release-v1.8.6`
+
+---
+
+## 🔍 故障排查
+
+### 问题 1：发布失败 - "401 Unauthorized"
+
+**原因**：NPM_TOKEN 未配置或已过期
+
+**解决**：
+1. 检查 GitHub Secret 是否存在
+2. 重新生成 npm token
+3. 更新 GitHub Secret
+
+---
+
+### 问题 2：发布失败 - "版本已存在"
+
+**原因**：npm 上已有相同版本号
+
+**解决**：
+```bash
+# 删除本地 tag
+git tag -d v1.8.6
+
+# 删除远程 tag
+git push origin :refs/tags/v1.8.6
+
+# 升级版本号
+npm version patch
+
+# 重新推送
+git push origin main --tags
+```
+
+---
+
+### 问题 3：版本号不一致错误
+
+**原因**：Tag 版本与 package.json 版本不匹配
+
+**解决**：
+```bash
+# 始终使用 npm version 命令（自动同步）
+npm version patch
+
+# 不要手动修改 package.json 后创建 tag
+```
+
+---
+
+### 问题 4：如何手动触发发布？
+
+如果自动发布失败，可以手动触发：
+
+```bash
+# 方法 1：使用 GitHub CLI
+gh workflow run npm-publish.yml
+
+# 方法 2：在 GitHub 网页手动触发
+# 访问：https://github.com/AltureT/hydro-ai-helper/actions
+# 选择 "Publish to npm" → "Run workflow"
+```
+
+---
+
+## 📊 监控发布状态
+
+### 查看 Actions 执行日志
+
+访问：https://github.com/AltureT/hydro-ai-helper/actions
+
+**成功标志**：
+- ✅ 绿色勾号
+- ✅ 日志中显示 "🎉 成功发布"
+
+**失败标志**：
+- ❌ 红色叉号
+- ❌ 日志中显示错误信息
+
+---
+
+### 验证发布成功
+
+```bash
+# 检查 npm 版本
+npm view hydro-ai-helper version
+
+# 检查 GitHub Release
+gh release list
+
+# 检查徽章
+curl https://img.shields.io/github/v/release/AltureT/hydro-ai-helper
+```
+
+---
+
+## 🔒 安全注意事项
+
+1. ✅ **NPM_TOKEN 是敏感信息**，仅保存在 GitHub Secrets 中
+2. ✅ **不要提交 token** 到代码仓库或 .npmrc
+3. ✅ **定期轮换 token**（建议 90-180 天）
+4. ✅ **限制 token 权限**（仅授予必要的包）
+5. ✅ **启用 2FA**（双因素认证）
+
+---
+
+## 📚 参考资源
+
+- GitHub Actions 文档：https://docs.github.com/en/actions
+- npm Publishing 指南：https://docs.npmjs.com/packages-and-modules/contributing-packages-to-the-registry
+- Semantic Versioning：https://semver.org/lang/zh-CN/
+
+---
+
+## ❓ 常见问题
+
+### Q1: 能否同时发布到多个 npm registry？
+
+可以，在 workflow 中添加多个发布步骤：
+
+```yaml
+- name: 发布到 npm
+  run: npm publish --access public
+  env:
+    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+- name: 发布到 GitHub Packages
+  run: npm publish --registry=https://npm.pkg.github.com
+  env:
+    NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+---
+
+### Q2: 如何发布 beta 版本？
+
+```bash
+# 创建 beta 版本
+npm version prerelease --preid=beta
+# 例如：1.8.5 → 1.8.6-beta.0
+
+# 推送
+git push origin main --tags
+
+# npm 上会标记为 beta
+npm install hydro-ai-helper@beta
+```
+
+---
+
+### Q3: 能否在发布前自动运行测试？
+
+可以，在 workflow 中添加测试步骤：
+
+```yaml
+- name: 运行测试
+  run: npm test
+
+- name: 发布到 npm
+  if: success()  # 仅测试通过时发布
+  run: npm publish
+```
+
+---
+
+**配置完成后，你只需要运行 `npm version patch && git push --tags`，其余全部自动化！**

package/.github/workflows/npm-publish.yml

@@ -0,0 +1,71 @@
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'  # 匹配 v1.0.0, v1.8.5 等格式的 tag
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write  # 需要写入权限以创建 Release
+
+    steps:
+      - name: Checkout 代码
+        uses: actions/checkout@v4
+
+      - name: 设置 Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: 安装依赖
+        run: npm ci
+
+      - name: 构建插件
+        run: npm run build:plugin
+
+      - name: 验证版本一致性
+        run: |
+          TAG_VERSION=${GITHUB_REF#refs/tags/v}
+          PKG_VERSION=$(node -p "require('./package.json').version")
+
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "❌ 错误：Tag 版本 ($TAG_VERSION) 与 package.json 版本 ($PKG_VERSION) 不一致"
+            exit 1
+          fi
+
+          echo "✅ 版本验证通过：$TAG_VERSION"
+
+      - name: 发布到 npm
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: 创建 GitHub Release
+        uses: softprops/action-gh-release@v1
+        with:
+          generate_release_notes: true  # 自动生成 Release Notes
+          draft: false
+          prerelease: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: 发布成功通知
+        if: success()
+        run: |
+          echo "🎉 成功发布 ${{ github.ref_name }} 到 npm"
+          echo "📦 npm: https://www.npmjs.com/package/hydro-ai-helper"
+          echo "🏷️ GitHub Release: ${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ github.ref_name }}"
+
+      - name: 发布失败通知
+        if: failure()
+        run: |
+          echo "❌ 发布失败，请检查日志"
+          echo "可能的原因："
+          echo "1. NPM_TOKEN 未配置或已过期"
+          echo "2. 版本号与 package.json 不一致"
+          echo "3. npm 包名已被占用"

package/.github/workflows/sync-releases-to-gitee.yml

@@ -44,12 +44,17 @@ jobs:
       - name: Check if release exists on Gitee
         id: check
         run: |
-          RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" \
+          # 获取 release 信息，如果不存在会返回错误信息
+          RESPONSE=$(curl -s \
             "https://gitee.com/api/v5/repos/alture/hydro-ai-helper/releases/tags/${{ steps.release.outputs.tag_name }}?access_token=${{ secrets.GITEE_ACCESS_TOKEN }}")
 
-          if [ "$RESPONSE" = "200" ]; then
+          # 检查返回的 JSON 是否包含 id 字段（存在）或 message 字段（不存在）
+          RELEASE_ID=$(echo "$RESPONSE" | jq -r '.id // empty')
+
+          if [ -n "$RELEASE_ID" ]; then
             echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Release already exists on Gitee, will update"
+            echo "release_id=${RELEASE_ID}" >> $GITHUB_OUTPUT
+            echo "Release already exists on Gitee (ID: ${RELEASE_ID}), will update"
           else
             echo "exists=false" >> $GITHUB_OUTPUT
             echo "Release does not exist on Gitee, will create"
@@ -70,13 +75,10 @@ jobs:
           fi
 
           if [ "${{ steps.check.outputs.exists }}" = "true" ]; then
-            # Get existing release ID
-            RELEASE_ID=$(curl -s \
-              "https://gitee.com/api/v5/repos/alture/hydro-ai-helper/releases/tags/${TAG_NAME}?access_token=${{ secrets.GITEE_ACCESS_TOKEN }}" \
-              | jq -r '.id')
+            # Update existing release using the ID from check step
+            RELEASE_ID="${{ steps.check.outputs.release_id }}"
 
-            # Update existing release
-            curl -X PATCH \
+            RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
               "https://gitee.com/api/v5/repos/alture/hydro-ai-helper/releases/${RELEASE_ID}" \
               -H "Content-Type: application/json" \
               -d "$(jq -n \
@@ -91,12 +93,21 @@ jobs:
                   name: $name,
                   body: $body,
                   prerelease: $prerelease
-                }')"
+                }')")
+
+            HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+            BODY=$(echo "$RESPONSE" | sed '$d')
 
-            echo "Release updated on Gitee"
+            if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "201" ]; then
+              echo "✅ Release updated on Gitee successfully"
+            else
+              echo "❌ Failed to update release on Gitee (HTTP $HTTP_CODE)"
+              echo "Response: $BODY"
+              exit 1
+            fi
           else
             # Create new release
-            curl -X POST \
+            RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
               "https://gitee.com/api/v5/repos/alture/hydro-ai-helper/releases" \
               -H "Content-Type: application/json" \
               -d "$(jq -n \
@@ -113,7 +124,16 @@ jobs:
                   body: $body,
                   target_commitish: $branch,
                   prerelease: $prerelease
-                }')"
+                }')")
+
+            HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+            BODY=$(echo "$RESPONSE" | sed '$d')
 
-            echo "Release created on Gitee"
+            if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
+              echo "✅ Release created on Gitee successfully"
+            else
+              echo "❌ Failed to create release on Gitee (HTTP $HTTP_CODE)"
+              echo "Response: $BODY"
+              exit 1
+            fi
           fi

package/TROUBLESHOOTING.md

@@ -317,6 +317,37 @@ pm2 logs hydrooj | grep TelemetryService
 
 ---
 
+## 一键更新（后台）故障排查
+
+### 1. 前置条件（必须）
+
+- `git`、`npm`、`gpg`、`pm2` 在服务器上可用（可执行且在 PATH 中）。
+- 插件目录包含 `assets/trusted-keys/publisher.asc`（用于校验发布者签名）。
+
+### 2. 常见失败原因
+
+1) **提示：未检测到可用的 gpg（GnuPG）**
+- 解决：安装 `gpg` 后重试（例如：Debian/Ubuntu `sudo apt-get install gnupg`；macOS `brew install gnupg`）。
+
+2) **提示：上游仓库未启用 GPG 签名 / 签名无效 / 指纹不在信任列表**
+- 说明：为保证更新代码来源可信，“一键更新”会强制校验最新 commit 的 GPG 签名，并核对发布者主密钥指纹白名单。
+- 解决：
+  - 确认上游 main 分支最新 commit 已签名；
+  - 确认签名主密钥指纹与插件内白名单一致；
+  - 若发布者更换密钥，需要更新 `assets/trusted-keys/publisher.asc` 与白名单指纹后再更新。
+
+3) **提示：依赖安装失败（默认禁用 npm scripts）**
+- 说明：为降低供应链风险，更新过程默认使用 `npm ci/install --ignore-scripts`，不会执行依赖包的 `install/postinstall` 脚本。
+- 解决（谨慎）：若确实需要执行 scripts 才能安装成功，可在运行 HydroOJ 的环境中设置：
+  - `AI_HELPER_UPDATE_ALLOW_NPM_SCRIPTS=1`
+  - 风险：启用后依赖包安装脚本可能在服务器上执行，请确认来源与变更可信。
+
+4) **页面提示 502 / 连接中断**
+- 说明：更新完成后会触发 `pm2 reload/restart hydrooj`，短时间内可能导致连接中断。
+- 解决：等待 15–20 秒刷新页面；必要时查看 `pm2 logs hydrooj`。
+
+---
+
 ## 常见问题汇总
 
 | 问题 | 原因 | 解决方案 |

package/assets/trusted-keys/publisher.asc

@@ -0,0 +1,63 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGl/UKQBEADPxMjTQKYLfzLzs6mZBF28WpYUOTLHQDVqpz23gCvzvVtYsRxF
+ARwAm7o8fQiQ20aBCd2sz9y8ppqAnNfvqls3aCfs9rU7zYqS9d6oWMHW5yRqN9uX
+4D7O+iqAoAk5O1bSo9LOUQ9l+D1GzDk0cKJbtrwfMt6HpRE7CjfCF3ulsFm+kpSe
+TLflaflFsSbPVQiy3SZpUI3U03zIJ7UDs5DVmh5gXUFht705kW2qYphG1t5N+2Ws
+XJ9K4fsGgrQAxxXEmZeI5sTWu79+Ud2MawwQkrBB4+poF4h74DRBYdDDqaODPjWC
+qoZqOwkO9rKokrz4Eg3YLuHd01c8fQcT53Z7S+ZXZvib2uq9h3A9poLMHA7Ot6/a
+XdTjy717XcT4uR6K/oClYl4jK35dWShLQZ+C3df+LC+anw6yV2+LSq28MyVeNy1X
+GTQ3aFQABO9VNUYvJ9mT5rbW6Yb16yaprCyxjxjbY5yTzW4thaKshVfP8jZHJvlN
+NT6St1++BajAQLEAmnChS6NTaYxiiY8fUkNK2sdu76oV4dx4WbvbyeFdE/UDWgbH
+rjCkG3kghqATrKq5e0tKF2tfPBHR6WrPsp9fSaIZYVptIo8QJjnh3Z/OsZmHgdtR
+QOV2qcRJdanJi6Jyq8AoX0+idZp4Kd+HrTbx2UFmRY6WtvtUG7sxujrO+wARAQAB
+tBxBbHR1cmVUIDxteWFsdHVyZUBnbWFpbC5jb20+iQJSBBMBCAA8FiEEthFa89Jx
+0Sq4XoQ+RdrMDs/pCFIFAml/UKQDGy8EBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4H
+AheAAAoJEEXazA7P6QhSYssP/RBgikIrN+HYzYr3P1p+S48Bqj6tt449yd8PI3jV
+d22D3NVfqhxL/OjeU9evenYVv+1ZXxIsBflwkyQH0OrG1U7SJcBgsUBSmj0xX0mX
+WH/TVA5pqfcgcCmhAnUW/X7iOHhgyVeavyOa9wiBNb+J5LLOQKumWe4KK6Gawnfg
+E7GJovYqk2Qa9/INOpMd9LuhwP5CP+FOj2POiCE4rO4MhAUqSTuLVzY4KZijLyI0
+A85qdEKkp4UedLQXorBf05+fD6z1tnzAfcL2I8O7eMMBlhrvD4qIgMqksWLM3pvb
+BSo7SadSPhahAXWFGiUSi18i+6fc8ocNlGcsRUOl+NTj6fLsAckPslDPdEEY1typ
+fyHYN5AZwR5dQjYJG+XT6e01QPHXU3a+XuhVaGthM5Ozg96T5gcxb2oKfqsYZlw/
+S7/n4qRavRvtT/7rE8Z/+kTFDuhHZy8H9EyUTWK2zrZ0Ra6X53CBztzGaSwC32y2
+HzPSZA7ngvtEwaQQPAAIC+l4OG+9i8nIgBfkJISPBM1KffGSQUmd5U2ezyAsA+99
+uLX3Vd3PYCyTpyUHOtuwKtD8WGNaLWtXInsSAENPBUSPIB9OtDVBw5VOTfiQbt5B
+WflHtoGqgXraLieKaln37gbjiE26Vr+bBbis85KC6jxM9wk52mIRb/j1JLHnHbLD
+zMnJuQINBGl/UKQBEADF4ov6F9aYJhc2PboMtKicAZLszBDMXS2bGe7aFWauQO2+
+kFc+iXFXYNxhqIVTrP6cGgaHp45NXemM9TWWwZPZzeWJLBDqbkNIqs5CcauG4P4n
+CR7BA1ilNGSbcuYz+mRf+caZ9Zp94AL/b/O7A43JuezZ76FWfy4DX2OaljI0Btj2
+E3bWmA7cAbzfGpxzt+mVRg9Tu75kto/DGCHRnhDoTu4cUSzpicRrokMzf+RSKvqE
+AA0rb32YLjFBrNsTzSWRHVsf1YlmXamVz4Fo0YoYXuj9K5FhUaWQj2xEkA0XxVuo
+KCos4KPL4rJk4mjwAsX4jOjDCox4Hjew7vbCa26vib5LyVD/ua4j5TOZL26NFnOF
+awRDaZNhJxnF+4JUxxEo84ttJErW5ugY/L93JU9cue3sEwv8HWPGnXvyXbRRSR/9
+UtAjgwKR1nudffh/bYGkITPI4itnMI0PR4UtnfYQJGfH06KU0GbaQsmGJWFX6QJt
+5Zvi0ifYwhBjJE8DnXvcwzip1us4/JS4v5f6tczwagR+DUF5z/mf1jPATEkuCEh1
+5nzd/+pnjQf0eS4EZf96uoZq7yZ1dNtGI18F26aGxSMsWolqKL7TgrzOcaGFmdp2
+1D23Yr8pfAdqcxgNnk4W75mSZeEbf80oi9XKqxzjOtO3RZMrVaO0w+Y4HLFkDQAR
+AQABiQRsBBgBCAAgFiEEthFa89Jx0Sq4XoQ+RdrMDs/pCFIFAml/UKQCGy4CQAkQ
+RdrMDs/pCFLBdCAEGQEIAB0WIQQue1LgZz61maBHilWet3dQVwhDDAUCaX9QpAAK
+CRCet3dQVwhDDPOMD/9C73CzcZAovSDTk0fbiB8uJUMg0Alzu5pAD0sGvVmscOHw
+3a3UYBv7q8iFaUw7v5w+l2QDlez4RNE+0utLviJ4FjSugYDd9trBPZKegOvqu0AT
+PTXSMbN50iRsk26SAcf476NxIiqscwZPsIWFs3be9VzebE0Cg2zZakR3CABXvj8m
+sOEx8j2/WTE5eRW311faw6wcH0R3izYrIpIO9ZaPoVWlA9c7AggG1bwV+e3iTP/C
+ekUAIwsRy1hp5CLdCms6g61f1+cIJ1qiOdMA6SyGGv5ROmgtiWMfQOwTCB7uGW9C
+YMx6hB09hg5zcRQ7RSGhNJYTRhDRJyi3fz8AqqKZku2L2PRMYT01FyXOaIjCPzIZ
+2q3uE7e4DcnEeeHDxag0jbzNN6qqkFVeQncYxeSBITX8cryVuAkfnmO1ej7j/T2A
+Q/VdZSP4ZlSVKj4FReOjW5L1Uafnsw31EBprrmSpoyqMZo6SklfPRKx7j0Fiq0HL
+L5yLNILOJiXdUWJBcI+/Z5FwgkLyL4Sz097Dkw+48uIwderiRgcg9SIn/1IoXr3V
+lim1YoTo9GsUT7W6yusgjOatUpzwxzk08YuKtPIIdF8LmqxGdmAs9NbOd/46NZGZ
+YCGkxipPHH/aYPRF8nPb7Awdmj7YNh31BwQXivKenssdlkSf9TlXNdy5WhLgNr2r
+D/902zEvOPA2mOF8yz7OXPu1LN6DnVmisqa+Wp+V76ViEuNVeWpu2c+g8+adHDwo
+2NzHGrNolobS0ryTGpqC07d68lPPQZYTTFtJpnAZ47aSIEk1O47YhluKcAwA2YUf
+tclEotqBI+TGVCZ8KxhS5+v7uUxjhGdme8LQivekCY8tgQyPTIDn1SLTLgmxrtYN
+CYrTF0cT+dVay5PooO0sJX2kdTeigKjV10JK6D7cGrRZ79rVNln/BNhxhwgyzzcJ
+hnVItkjQHJgqQcapdewemTf3wWyQT0mRZE3XKZPuZs9TiMAos8abOcawtdP9+lI5
+II0WZ7xyHUrr2vlH/jHe6v7Ims7MQHRUfTc2AQvC+h9K2UzeJq8fbDLlL3B3tM31
+NOQZJukWCeIih/ebL640B2jCd6EXA2hgFxIcRSl7QovHND0rMBv2JzoyIP0WygU8
+DpNgTBPMnPohRuYur0U8Q25T8DuP1nga9MqttjTth4ZS2ubcSLG+d+/Knd3Ng1xU
+sXuLDyDLVqR67TRj+OrdSIw+kavuBF7+ak+IHEZX0tcQH1it3037VsNGnXZBzWGX
+sRkstzhW4/Boz9j/L1S4vjGA/2ZVOHclKkBFtHUS9vKkplXWGvWMeau1RtuJk5qs
+JFxc5v2XdAqvHE4Rniv4rr0Ym5YgYT7hzMU78RGSk3mUSw==
+=ElGs
+-----END PGP PUBLIC KEY BLOCK-----

package/dist/handlers/updateHandler.js

@@ -55,6 +55,11 @@ exports.UpdateInfoHandlerPriv = hydrooj_1.PRIV.PRIV_EDIT_SYSTEM;
 class UpdateHandler extends hydrooj_1.Handler {
     async post() {
         try {
+            // 🔒 强制管理员权限检查（防御路由配置被绕过）
+            if (!this.user.hasPerm(hydrooj_1.PRIV.PRIV_EDIT_SYSTEM)) {
+                console.warn(`[UpdateHandler] 权限不足: 用户 ${this.user._id} 尝试执行更新操作`);
+                return (0, httpHelpers_1.setErrorResponse)(this, 'PERMISSION_DENIED', '执行插件更新需要管理员权限。更新操作会修改代码并重启服务，仅允许管理员执行。', 403);
+            }
             const updateService = new updateService_1.UpdateService();
             // 收集所有日志
             const allLogs = [];

package/dist/handlers/updateHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"updateHandler.js","sourceRoot":"","sources":["../../src/handlers/updateHandler.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,qCAAwC;AACxC,6DAA0D;AAC1D,oDAAuE;AAEvE;;;;;;;;;;GAUG;AACH,MAAa,iBAAkB,SAAQ,iBAAO;IAC5C,KAAK,CAAC,GAAG;QACP,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC;YAE3C,IAAA,6BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,IAAA,8BAAgB,EAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;CACF;AAZD,8CAYC;AAED,uBAAuB;AACV,QAAA,qBAAqB,GAAG,cAAI,CAAC,gBAAgB,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAa,aAAc,SAAQ,iBAAO;IACxC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,6BAAa,EAAE,CAAC;YAE1C,SAAS;YACT,MAAM,OAAO,GAAa,EAAE,CAAC;YAE7B,OAAO;YACP,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;gBAC7D,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,CAAC;YAEH,IAAA,6BAAe,EAAC,IAAI,EAAE;gBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAC7C,IAAA,8BAAgB,EAAC,IAAI,EAAE,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;CACF;AA3BD,sCA2BC;AAED,uBAAuB;AACV,QAAA,iBAAiB,GAAG,cAAI,CAAC,gBAAgB,CAAC"}
+{"version":3,"file":"updateHandler.js","sourceRoot":"","sources":["../../src/handlers/updateHandler.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,qCAAwC;AACxC,6DAA0D;AAC1D,oDAAuE;AAEvE;;;;;;;;;;GAUG;AACH,MAAa,iBAAkB,SAAQ,iBAAO;IAC5C,KAAK,CAAC,GAAG;QACP,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC;YAE3C,IAAA,6BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,IAAA,8BAAgB,EAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;CACF;AAZD,8CAYC;AAED,uBAAuB;AACV,QAAA,qBAAqB,GAAG,cAAI,CAAC,gBAAgB,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAa,aAAc,SAAQ,iBAAO;IACxC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,0BAA0B;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;gBACnE,OAAO,IAAA,8BAAgB,EACrB,IAAI,EACJ,mBAAmB,EACnB,wCAAwC,EACxC,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,6BAAa,EAAE,CAAC;YAE1C,SAAS;YACT,MAAM,OAAO,GAAa,EAAE,CAAC;YAE7B,OAAO;YACP,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;gBAC7D,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,CAAC;YAEH,IAAA,6BAAe,EAAC,IAAI,EAAE;gBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAC7C,IAAA,8BAAgB,EAAC,IAAI,EAAE,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;CACF;AAtCD,sCAsCC;AAED,uBAAuB;AACV,QAAA,iBAAiB,GAAG,cAAI,CAAC,gBAAgB,CAAC"}